Skip to content

Container Registry

Overview

Customers can use their existing Container Registry or the integrated Container Registry on the Controller.

Workloads based on the "workload wizard" can be configured to securely access enterprise container registries. The following Container Registry Providers have been tested for compatibility.

  • Docker Hub (Public)
  • Docker Hub (Private)
  • AWS ECR
  • GCP GCR
  • Quay by RedHat
  • Nexus by Sonatype
  • JFrog Artifactory
  • Microsoft MCR
  • System Container Registry
  • Any Docker Compatible Registry

Registry Integrations

The Controller provides deep integrations with 3rd party container registry providers to help streamline and secure access to it.

Credential Configuration

Users can securely configure and use registry provider specific access credentials.

Image Pull Secret Injection

When a workload is published on a managed cluster, the Controller will ensure that the necessary "image pull secrets" are automatically injected into the underlying Kubernetes "secrets" resources.

Kubernetes handles the pulling and running of the image once the pod is configured with appropriate imagePullSecrets.

Container Registries


Docker Hub

Docker Hub is a service provided by Docker for finding and sharing container images. In addition to public repositories, organizations can also create private (credential protected) repositories. Docker Hub is also one of the locations where ISVs publish their official images.

Public Repositories

The Controller provides out of box support for "public repositories" in Docker Hub. No special configuration is required to access images from DockerHub's public repositories.

Private Repositories

For Private Repositories on Docker Hub, create a new Registry Profile

  • Click on New Registry
  • Provide a name and access credentials

Docker Hub

The Controller will automatically perform validation of the access credentials to ensure that downstream clusters will have access to the private repo to pull the required container images.

Once the registry profile has been created, users can provide the repository name, image and tag directly in the container configuration page.


AWS ECR

AWS's Elastic Container Registry aka ECR is a fully-managed Docker container registry that makes it easy for developers to store, manage, and deploy Docker container images.

  • ECR eliminates the need to operate your own container repositories or worry about scaling the underlying infrastructure.
  • ECR hosts your images in a highly available and scalable architecture, allowing you to reliably deploy containers for your applications.

  • ECR is AWS region specific

  • The registry endpoint is of the form aws_account_id.dkr.ecr.region.amazonaws.com
  • Cross account access is supported by ECR which is controlled by Amazon ECR Repository Policies

Step 1: AWS Permissions

The ECR registry service allows users to provide fine-grained permissions that are tied into Amazon’s IAM service. Configure the minimum permissions required to pull images from ECR.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecr:GetAuthorizationToken",
                "ecr:BatchCheckLayerAvailability",
                "ecr:GetDownloadUrlForLayer",
                "ecr:GetRepositoryPolicy",
                "ecr:DescribeRepositories",
                "ecr:ListImages",
                "ecr:DescribeImages",
                "ecr:BatchGetImage"
            ],
            "Resource": "*"
        }
    ]
}

Step 2: Registry Profile

In the Web Console, Select Registry

  • Click on New Registry
  • Provide the registry endpoint information (An example of an ECR Endpoint is "6391436758854.dkr.ecr.us-west-1.amazonaws.com")
  • Provide access credentials for programmatic access to AWS

ECR Profile

Authentication

Access to ECR is controlled by AWS IAM. AWS requires an IAM user to request a temporary credential to access the registry. Once issued, this temporary credential is valid for 12 hours. The in-cluster k8s management operator will automatically refresh the credentials before they expire to ensure that managed clusters never lose access to container images in ECR.

Step 3: Use Image from ECR

Once the registry profile for AWS ECR has been created, you can use it directly in the container configuration

  • In the registry dropdown, select the ECR registry profile
  • Provide the "repository" and "tag information

Before the workload is published, the Rafay platform will "validate" whether the repository and image exists and is accesible using the credentials. This proactive check ensures that an "image pull" failure does not occur at the managed clusters.


GCP GCR

The controller enables customers to deploy containers from their GCR repos. GCP has multiple registry endpoints

  • gcr.io currently hosts the images in the United States
  • us.gcr.io hosts the image in the United States, in a separate storage bucket from images hosted by gcr.io
  • eu.gcr.io hosts the images in the European Union
  • asia.gcr.io hosts the images in Asia

Users can create different registry profiles if they need to use images from different registry endpoints.

Step 1: GCP Permissions

Set the following permissions for the "service account" you intend to use. This is required to pull images from the GCR repos.

  • storage.objects.get
  • storage.objects.list

Step 2: Registry Profile

In the Web Console, Select Registry

  • Click on New Registry
  • Provide the registry endpoint information
  • Provide access credentials information (service account JSON)

Unlike AWS ECR, the credentials are long-lived and do not require refreshes unless they are explicitly rotated. A GCR Repository URI is of the form [HOSTNAME]/[PROJECT-ID]/[IMAGE].

GCR

Step 3: Use Image from GCR

Once the registry profile for GCR has been created, you can use it directly in the container configuration

  • In the registry dropdown, select the GCR registry profile
  • Provide the "repository" and "tag information

Before the workload is published, the Rafay platform will "validate" whether the repository and image exists and is accesible using the credentials. This proactive check ensures that an "image pull" failure does not occur at the managed clusters.


Custom Registry

Use the "Custom Registry" option for access to any Docker Compatible Registry. For access to repositories on JFrog, Nexus and Quay can be quickly configured using this option.

  • Provide a name for the Registry (ideally something your developers can instantly recognize)
  • Select "Custom" from the dropdown
  • Provide the Registry Endpoint (NOTE: Self signed certificates are not supported by the https endpoint)
  • Provide authentication credentials

Custom Registry


Microsoft Container Registry (MCR)

Microsoft Corporation distributes their images/samples via unauthenticated access from Microsoft Container Registry (MCR). The Microsoft Container Registry (MCR) hosts popular repositories for popular container images provided by Microsoft Corporation (For example, the .NET Core container images etc.)

To enable access to MCR,

  • Create a new registry (provider) called MCR etc
  • Select "Custom" for Provider
  • Enter "mcr.microsoft.com" for Registry Endpoint
  • Do Not enter username and password

Now you can use the MCR registry profile in your container configs.


Suystem Container Registry

Users that have not yet selected a corporate Container Registry may be interested in using the Integrated Container Registry in the Controller. This supports Docker's Image Manifest v2.

Accessing the Registry

  • Users can use a standard Docker client to securely interact with the Integrated Container Registry.
  • Users can also view/manage their images in the Integrated Container Registry via the Console.

Integrated Container Registry

Using the Registry

For workloads based on the "workload wizard",

  • In the container configuration, select "System Default Registry" from the dropdown
  • Select the "image name" and "tag" from the drop down list